CVE-2026-25731

ثغرة حقن القوالب من جانب الخادم SSTI في محرك Templite الخطورة: عالية CVSS 7.8 البرنامج المتأثر: calibre تم التصحيح في الإصدار: 9.2.0 النشرة الأمنية: GHSA-xrh9-w7qx-3gcc الملخص ثغرة حقن القوالب من جانب الخادم SSTI في محرك القوالب Templite الخاص ببرنامج Calibre تسمح بتنفيذ أكواد عشوائية عندما يقوم...

mpDNS

mpDNS उर्फ बहुउद्देशीय DNS सर्वर सरल, कॉन्फ़िगरेबल DNS सर्वर जिसमें कई उपयोगी सुविधाएँ हैं Python 3 names.db - सभी कस्टम रिकॉर्ड रखता है उदाहरण देखें .example.com जैसे सरल वाइल्डकार्ड यूनिकोड DNS अनुरोधों को पकड़ें कस्टम क्रियाएँ उर्फ मैक्रो: shellexec::dig google.com +short - शेल कमांड निष्पादित...

CVE-2025-2945-pgadmin-rce

CVE-2025-2945 — pgAdmin 4 Query Tool प्रमाणित RCE CVE-2025-2945 के लिए प्रूफ ऑफ कॉन्सेप्ट, pgAdmin 4 में एक गंभीर रिमोट कोड निष्पादन भेद्यता। प्रभावित संस्करण: 8.10 से 9.1 तक में स्थिर: 9.2 4 अप्रैल 2025 को जारी CVSS v3.1: 9.9 गंभीर अवलोकन pgAdmin 4 क्वेरी टूल एक एंडपॉइंट उजागर करता है जो...

CVE-2026-100865

Heym before 0.0.53 evaluates workflow condition expressions using Python's eval with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process use...

CVE-2026-100840

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves target values to arbitrary importable callables without an allow list and passes $ expressions to Python eval. Attackers can publish a malicious bundle with crafted configuration...

PYSEC-2026-4015

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves target values to arbitrary importable callables without an allow list and passes $ expressions to Python eval. Attackers can publish a malicious bundle with crafted configuration...

PYSEC-2026-4015

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves target values to arbitrary importable callables without an allow list and passes $ expressions to Python eval. Attackers can publish a malicious bundle with crafted configuration...

CVE-2026-100865

The Heym workflow automation platform, in versions before 0.0.53 , is vulnerable to Remote Code Execution (RCE) due to insufficient sandboxing when evaluating workflow condition expressions using Python's eval() function in the workflow executor service. Authenticated users can exploit this by ed...

CVE-2026-100865 Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape

Heym before 0.0.53 evaluates workflow condition expressions using Python's eval with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process use...

EUVD-2026-87830

Heym before 0.0.53 evaluates workflow condition expressions using Python's eval with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process use...

EUVD-2026-87848

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves target values to arbitrary importable callables without an allow list and passes $ expressions to Python eval. Attackers can publish a malicious bundle with crafted configuration...

CVE-2026-100840

The MONAI library (through version 1.6.0 ) contains a Remote Code Execution vulnerability within its bundle configuration engine . The root cause is that the engine resolves _target_ values to arbitrary importable callables without an allow list and passes $ expressions to Python's eval(). An att...

CVE-2026-100840 MONAI through 1.6.0 Remote Code Execution via bundle configuration

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves target values to arbitrary importable callables without an allow list and passes $ expressions to Python eval. Attackers can publish a malicious bundle with crafted configuration...

CVE-2026-100840 MONAI through 1.6.0 Remote Code Execution via bundle configuration

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves target values to arbitrary importable callables without an allow list and passes $ expressions to Python eval. Attackers can publish a malicious bundle with crafted configuration...

CVE-2026-100840 MONAI through 1.6.0 Remote Code Execution via bundle configuration

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves target values to arbitrary importable callables without an allow list and passes $ expressions to Python eval. Attackers can publish a malicious bundle with crafted configuration...

PT-2026-105776

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves target values to arbitrary importable callables without an allow list and passes $ expressions to Python eval. Attackers can publish a malicious bundle with crafted configuration...

PT-2026-99485

Name of the Vulnerable Software and Affected Versions Heym versions prior to 0.0.53 Description Multiple security issues exist in the software. The workflow condition evaluator uses the Python eval function without an effective sandbox, enabling users who can edit workflow branch/condition nodes ...

CVE-2026-100840: Improper Neutralization of Directives in Dynamically Evaluated Code

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves target values to arbitrary importable callables without an allow list and passes $ expressions to Python eval. Attackers can publish a malicious bundle with crafted configuration...

CVE-2026-61667

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py checkDataset, where...

CVE-2026-61667 DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py checkDataset, where...